CVE-2026-44882: Portainer Kubernetes Authorization Bypass Vulnerability

Technical summary

The kubeClientMiddleware component in Portainer handles token validation before forwarding Kubernetes API requests to backend clusters. When the security.RetrieveTokenData function encounters an error during secondary token validation, the middleware writes an HTTP 403 response but omits a return statement. Execution proceeds into the handler with a nil tokenData value, allowing the request to be forwarded to the Kubernetes cluster without proper authorization verification. This affects both Community Edition and Enterprise Edition codebases. The outer AuthenticatedAccess bouncer ensures only users with a valid Portainer session can reach this middleware, limiting the attack surface but not eliminating the risk for insufficiently-permissioned users.

Business impact

An authenticated user who should lack access to a specific Kubernetes cluster managed through Portainer can bypass authorization controls and interact directly with that cluster's API. This could enable unauthorized data exfiltration, workload modification or deletion, credential theft from cluster secrets, or lateral movement to other infrastructure. Organizations relying on Portainer's permission model for multi-tenant Kubernetes environments face elevated risk of privilege escalation and data exposure within their container orchestration platforms.

Affected systems

Portainer Community Edition versions 2.33.0 through 2.33.7 are affected. The vulnerability also exists in the corresponding Enterprise Edition versions within the same range. Systems managing Docker Swarm, Kubernetes, or ACI environments through these Portainer versions are at risk. Mitigation requires upgrading to version 2.33.8 or later.

Exploitability

Exploitation requires an attacker to possess a valid Portainer user account with an active session, limiting this to authenticated insiders or users granted legitimate Portainer access. No network authentication or user interaction is required beyond initial session establishment. The attack is straightforward to execute—any request to a Kubernetes endpoint where the user lacks secondary permissions will trigger the vulnerability. The CVSS 3.1 score of 8.1 (HIGH severity) reflects the high confidentiality and integrity impact despite the requirement for valid credentials.

Remediation

Upgrade Portainer to version 2.33.8 or later, which includes the corrected kubeClientMiddleware logic with proper return statement handling. Organizations should prioritize this patch for any multi-tenant Portainer deployments where users have differentiated access to Kubernetes clusters. Until patching is possible, restrict Portainer access to highly trusted administrators and monitor Kubernetes API audit logs for unexpected or unauthorized requests originating through Portainer.

Patch guidance

Deploy Portainer 2.33.8 or newer across all affected installations. Review your current Portainer version via the web interface (Settings > About) or CLI. Plan patching during a maintenance window to avoid service interruption to running containers. Verify that all container hosts and Kubernetes clusters remain accessible and operational post-upgrade by testing workload deployment and cluster connectivity through the Portainer UI.

Detection guidance

Monitor Portainer access logs for requests to Kubernetes endpoints by users or roles that should not have permission to those endpoints. Inspect Kubernetes API audit logs for requests that originated through Portainer's proxy layer with authorization errors or unexpected access patterns. Check Portainer's middleware and authentication logs for 403 responses followed by subsequent successful requests in quick succession, which may indicate exploitation. Use network intrusion detection to flag API requests from Portainer to Kubernetes clusters from unexpected service accounts or with suspicious patterns.

Why prioritize this

Although exploitation requires a valid Portainer session, this vulnerability enables privilege escalation within container orchestration environments. Kubernetes access often grants broad capabilities over production infrastructure. Organizations with multi-tenant Portainer deployments should prioritize this patch immediately. Less critical for single-administrator deployments but still important to address promptly given the high CVSS score and the sensitivity of Kubernetes cluster access.

Risk score, explained

The CVSS 3.1 score of 8.1 reflects HIGH severity due to high impact on confidentiality and integrity of Kubernetes resources. The attack vector is network-accessible, requires low complexity, and demands only low privileges (a valid Portainer session) with no user interaction. The scope is unchanged and availability is not impacted. The score appropriately reflects the practical risk: authenticated users can escalate their privileges within managed clusters, but exploitation is limited to those already holding some form of Portainer access.

Frequently asked questions